Table of Contents
Advertisement
34.6 Dynamic Update of Zone Data
The term dynamic update refers to operations by which entries in the zone files of a
master server are added, changed, or deleted. This mechanism is described in RFC 2136.
Dynamic update is configured individually for each zone entry by adding an optional
allow-update or update-policy rule. Zones to update dynamically should not
be edited by hand.
Transmit the entries to update to the server with the command nsupdate. For the
exact syntax of this command, check the manual page for nsupdate (man 8 nsupdate).
For security reasons, any such update should be performed using TSIG keys as described
in
Section 34.7, "Secure Transactions"
(page 651).
34.7 Secure Transactions
Secure transactions can be made with the help of transaction signatures (TSIGs) based
on shared secret keys (also called TSIG keys). This section describes how to generate
and use such keys.
Secure transactions are needed for communication between different servers and for
the dynamic update of zone data. Making the access control dependent on keys is much
more secure than merely relying on IP addresses.
Generate a TSIG key with the following command (for details, see
man dnssec-keygen):
dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2
This creates two files with names similar to these:
Khost1-host2.+157+34265.private Khost1-host2.+157+34265.key
The key itself (a string like ejIkuCyyGJwwuN3xAteKgg==) is found in both files.
To use it for transactions, the second file (Khost1-host2.+157+34265.key)
must be transferred to the remote host, preferably in a secure way (using scp, for exam-
ple). On the remote server, the key must be included in the file /etc/named.conf
to enable a secure communication between host1 and host2:
key host1-host2. {
algorithm hmac-md5;
The Domain Name System
651
Advertisement
Table of Contents
Troubleshooting
