Implementing DNSSEC using Bind

Modifying a Signed Zone

All signed zones are located in /var/named/dnssec_zones. To modify a signed zone, simply modify the unsigned zone file in the same directory (e.g. /var/named/db.domain.gov), increment its time-stamp then sign the zone again with the existing keys using the following commands:

Note that you can find which key is the key signing key (KSK) and which one is the zone signing kye (ZSK) by looking at the includes in the unsigned zone (e.g. /var/named/db.domain.gov).

After signing the new zone, you can simply reload the signed zone by runing:

Signing a Zone

Here in this example, I sign domain.gov. You can use the same method to sign any zone for DNSSEC implementation.

DNSSEC

*Here is what's returned*

Copy *domain.gov*.key files to /var/named/dnssec_keys/

*Sign the zone*
vim /var/named/db.domain.gov

Add the following at the end of the zone and increment the timestamp of the zone:

cd /var/dnssec
dnssec-signzone -a -k Kdomain.gov.+005+01729 -o domain.gov -e +7776000 /var/named/db.domain.gov Kdomain.gov.+005+15032

*Here is whats returned*

*Move both Zones (original and signed) to /var/named/dnssec_zones*

mv /var/named/db.domain.gov* /var/named/dnssec_zones

*Load the signed Zone*

add the zone section for domain.gov with the following:

Remove the zone section for domain.gov from /var/named/zones.main

move the regular zone to dnssec_zones folder

Customer needs /var/dnssec/keyset-domain.gov. to enable DNSSEC with the zone root servers:

$ORIGIN .
domain.gov            600     IN DNSKEY 257 3 5 (
                                        AwEAAcacKLXhmESZgCL7OlqNhH7W/FMdVndm
                                        zzxjJ3nzbvZyhasdfsdfsdfsdfdfdCMPtERd
                                        i6hi2bn5wasdfasdfasdfasdfasdfoh6M5fE
                                        nOGQkotJ976U8XpABg6SVlAPn+avTtG8zaJQ
                                        I63aJEx6O1/dhZ7ATTgzUxvuWmJQipcgApxZ
                                        158Cy175QsAjJtR2QBg+QYLCRfPWpXEYnFhI
                                        7DtAasdfasdfasdfasVxLQASgv4T0dmeyMFf
                                        7VC9dc9kXDasdfsdfsadfsadfasdfaDKMaFb
                                        ZiaasdfasdfasdfasdfasdfasdfasdfasL0m
                                        FfoOI1uYUM9cs16wRys6qXU=
                                        ) ; key id = 1729

*If the bind9 server is not setup for dnssec yet do the following*

in the in the 'options' section add:

then restart bind

Now you are ready to upload the keyset you generated to the parent DNS delegate.

Rollover ZSK

Phase1

Rolling over ZSK for db.domain2.gov

Change the following lines in /var/named/dnssec_zones/db.domain2.gov

to:

Update the timestamp then sign the zone with the Standby ZSK (which would make it the active ZSK) using this command:

Regenerating Keys

1. Generate new keys for the domain in question

   cd /var/dnssec
   dnssec-keygen \-r /dev/urandom \-f KSK \-a RSASHA1 \-b 2048 \-n ZONE [domain.tld]
   dnssec-keygen \-r /dev/urandom \-a RSASHA1 \-b 1024 \-e \-n ZONE [domain.tld]
   dnssec-keygen \-r /dev/urandom \-a RSASHA1 \-b 1024 \-e \-n ZONE [domain.tld]
   cp [domain.tld]*.key /var/named/dnssec_keys/

2. Generate new zonefile (do not overwrite existing zone)

   cp /var/named/db.[domain.tld] /var/named/new.[domain.tld]

3. Update new zone file (vim /var/named/new.domain.tld)
   Replace the existing key include lines as shown below with the new output produced by the keys generated in step #1

   $include /var/named/dnssec_keys/K[domain.tld].+005+01729.key ; KSK
   $include /var/named/dnssec_keys/K[domain.tld].+005+15032.key ; ZSK
   $include /var/named/dnssec_keys/K[domain.tld].+005+20027.key ; pre-published ZSK

4. Sign the new zone file

   cd /var/dnssec
   dnssec-signzone \-a \-k K[domain.tld].+005+01729 \-o [domain.tld] \-e \+7776000 /var/named/new.[domain.tld] K[domain.tld].+005+15032
   mv /var/named/new.[domain.tld].signed /var/named/dnssec_zones

5. Provide the customer with the updated public key from /var/dnssec/keyset-domain.tld.signed
   
   
6. Schedule cut over from old zonefile to new zonefile, this should be done in concert with the customer's update of the registrar's TLD copy

   mv /var/named/dnssec_zones/new.[domain.tld].signed /var/named/dnssec_zones/db.[domain.tld].signed
   rndc reload [domain.tld]