Authenticate DNS Zone Transfer with TSIG

TSIG (Transaction Signatures) provides authentication and data integrity for the communication between servers. This communication includes zone transfers, notifications, recursive queries or dynamic updates. A shared secret will be generated in one of both servers and the same secret with the same name will be configured in them. Bear in mind that TSIG only provides authentication and data integrity and doesn’t provide encryption for the communication.

DNS Master

– Generate a new key:

# dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST -r /dev/urandom transfer

– Include the new key generated to the bind config files:

# cat Ktransfer.+165+09240.private
Private-key-format: v1.3
Algorithm: 165 (HMAC_SHA512)
Key: umWniLJJuw0K8sxz8NJzl7Cm3GmrfFv6UBpzEYtO8f6uvwcrzDvI4VgP0LLHiFZBl9JhUoD7CrO1WNfg163DDA==

# vi /etc/bind/transfer.key

key "transfer-key" {
algorithm HMAC-SHA512;
secret "umWniLJJuw0K8sxz8NJzl7Cm3GmrfFv6UBpzEYtO8f6uvwcrzDvI4VgP0LLHiFZBl9JhUoD7CrO1WNfg163DDA==";
};

# vi /etc/bind/named.conf

include "/etc/bind/transfer.key";

– Assign the new key to the zone to be transfer:

# vi /etc/bind/named.conf.default-zones

zone "domain.local" {
type master;
file "/etc/bind/db.domain.local";
allow-transfer { key "transfer-key"; };
};

– Restart the daemon:

# service bind9 restart

DNS Slave

– Copy the same key on the master and include on the configuration zone:

# vi /etc/bind/transfer.key

key "transfer-key" {
algorithm HMAC-SHA512;
secret "umWniLJJuw0K8sxz8NJzl7Cm3GmrfFv6UBpzEYtO8f6uvwcrzDvI4VgP0LLHiFZBl9JhUoD7CrO1WNfg163DDA==";
}

server 192.168.1.129 { keys "transfer-key";};

# vi /etc/bind/named.conf

include "/etc/bind/transfer.key";

– Configure the zone on the slave to transfer the information from the master:

# vi /etc/bind/named.conf.default-zones

zone "domain.local" {
        type slave;
        file "/etc/bind/db.domain.local";
        masters { 192.168.1.129; };
};

– Setup the correct permissions:

# chown -R bind:bind /etc/bind

– Restart the daemon:

# service bind9 restart

– Checking the transfer zone is completed successfully:

Sources

http://www.bind9.net/manual/bind/9.3.2/Bv9ARM.ch04.html#tsig