Reference Manual Version 2.4.2 Contents
Total Page：16
File Type：pdf, Size：1020Kb
Reference manual version 2.4.2 Contents 1 Introduction 7 1.1 Domain Name System................................... 8 1.1.1 Zones ........................................ 8 1.1.2 Authoritative name servers ............................ 9 2 Resource Requirements 11 2.1 Hardware .......................................... 11 2.1.1 CPU......................................... 11 2.1.2 Memory....................................... 11 2.2 Supported Operating Systems............................... 11 3 Installation 13 3.1 Server ............................................ 13 3.2 Client ............................................ 13 3.3 Libraries........................................... 14 3.4 From Sources........................................ 14 3.4.1 Configure Options ................................. 14 3.4.2 Server installation ................................. 16 3.5 From Packages ....................................... 17 3.5.1 RHEL/CentOS/Fedora .............................. 17 3.5.2 Debian........................................ 18 3.5.3 Ubuntu ....................................... 18 3.5.4 Arch Linux ..................................... 19 3.5.5 Gentoo ....................................... 20 3.5.6 FreeBSD....................................... 20 3.5.7 OpenBSD...................................... 20 3.5.8 Solaris........................................ 20 3.5.9 macOS ....................................... 21 4 Server Configuration 22 4.1 An authoritative name server............................... 24 4.1.1 Primary name server................................ 24 4.1.2 Secondary name server............................... 24 4.2 Signals............................................ 25 5 Server Technical 26 5.1 Zone file reader....................................... 26 5.1.1 Known types .................................... 27 6 Client 28 6.1 YADIFA........................................... 28 6.1.1 Control commands................................. 30 7 Key Roll 41 7.1 Introduction......................................... 41 7.2 Configuration........................................ 42 7.3 Generate time format ................................... 44 7.3.1 Command line ................................... 45 7.3.2 Primary name server side setup.......................... 45 7.3.3 yakeyrolld first sequence.............................. 46 7.3.4 yakeyrolld runtime usage ............................. 46 7.3.5 Extend the time covered by the steps ...................... 47 8 Domain Name System Security Extensions (DNSSEC) 50 8.1 Introduction......................................... 50 8.2 DNSSEC overview ..................................... 50 8.3 Types of key pairs ..................................... 52 8.4 Algorithms ......................................... 52 9 DNSSEC Policies 53 9.1 Introduction......................................... 53 9.2 What is needed for DNSSEC?............................... 53 9.2.1 Keys for signing .................................. 53 9.2.2 Signed zone..................................... 55 9.2.3 Delegated zone................................... 56 9.3 What is needed for yadifa? ................................ 56 9.3.1 Zone......................................... 57 9.3.2 DNSSEC-Policy .................................. 57 9.3.3 Denial........................................ 58 9.3.4 Key Suite...................................... 60 9.3.5 Key Template.................................... 61 9.3.6 Key-roll....................................... 62 10 DNS Name Server Identifier (NSID) 65 10.1 Introduction......................................... 65 10.2 NSID payload........................................ 65 11 DNS Response Rate Limiting (RRL) 67 11.1 Introduction......................................... 67 11.2 What is it? ......................................... 67 11.3 The problem ........................................ 67 11.4 A solution.......................................... 68 12 Resource Record Signature[51](RRSIG) Update Allowed 69 12.1 Introduction......................................... 69 12.2 The problem ........................................ 69 12.3 A solution.......................................... 69 13 Multi Primary Name Server 71 13.1 Introduction......................................... 71 13.1.1 Design........................................ 71 13.2 What is needed? ...................................... 78 13.2.1 Zone......................................... 78 14 Configuration Reference 79 14.1 Layout............................................ 79 14.2 Types ............................................ 81 14.3 Sections........................................... 82 14.3.1 <main> section .................................. 82 14.3.2 <zone> sections .................................. 87 14.3.3 <key> sections................................... 90 14.3.4 <acl> section.................................... 91 14.3.5 <channels> section ................................ 92 14.3.6 <loggers> section ................................. 95 14.3.7 <nsid> section................................... 98 14.3.8 <rrl> section.................................... 99 14.3.9 <dnssec-policy> section..............................100 14.3.10 <key-suite> section ................................101 14.3.11 <key-roll> section.................................101 14.3.12 <key-template> section ..............................102 14.3.13 <denial> section..................................103 15 Zones 105 15.1 Macros............................................105 15.1.1 @ ..........................................106 15.1.2 $INCLUDE.....................................106 15.1.3 $ORIGIN......................................107 15.1.4 $TTL ........................................108 15.2 Classes............................................108 15.3 Resource record types ...................................109 16 Journal 112 17 Statistics 114 18 Configuration Examples 117 18.1 Introduction.........................................117 18.2 YADIFA as a primary name server............................118 18.2.1 The One That is Really Easy...........................118 18.2.2 The One With Activation of Logging.......................119 18.2.3 The One With NSID................................121 18.2.4 The One With RRL ................................122 18.2.5 The One With DNSSEC Policy ‘diary’ style...................124 18.2.6 The One With DNSSEC Policy ‘relative’ style . 126 18.2.7 The One With RRSIG Update Allowed .....................128 18.2.8 The One With the Controller...........................130 18.3 YADIFA as a secondary name server...........................132 18.3.1 The One With One Primary ...........................132 18.3.2 The One With Several Primaries.........................133 18.3.3 The One With Activation of Logging.......................134 18.3.4 The One With NSID................................136 18.3.5 The One With RRL ................................137 19 Troubleshooting 139 19.1 Submitting a bug report..................................139 19.2 Stacktrace..........................................142 19.2.1 Using a core dump.................................143 19.2.2 Running yadifad in the debugger.........................144 19.3 Building yadifad with even more debugging information . 145 Bibliography 146 Index 150 List of Figures 1.1 DNS hierarchy........................................ 9 18.1 Primary name server (simple configuration) .......................118 18.2 Primary name server with logging.............................119 18.3 Primary name server with NSID..............................121 18.4 Primary name server with RRL ..............................122 18.5 Primary name server (DNSSEC policy ‘diary’ style)...................124 18.6 Primary name server (DNSSEC policy ‘relative’ style)..................126 18.7 Primary name server (RRSIG Update Allowed) .....................128 18.8 Primary name server with controller............................130 18.9 Secondary name server (one primary)...........................132 18.10 Secondary name server (several primaries) ........................133 18.11 Secondary name server with logging............................134 18.12 Secondary name server with NSID.............................136 18.13 Secondary name server with RRL.............................137 1 Introduction “Yet Another DNS Implementation For All” (YADIFA) is a name server implementation developed by EURid vzw/absl (EURid), the registry for the .eu top-level domain name. EURid devel- oped YADIFA to increase the robustness of the .eu name server infrastructure by adding a stable alternative to the other name server implementations in use. In a nutshell, YADIFA: is an authoritative name server, in both a primary and secondary Domain Name System[44] (DNS) server configuration is Request for Comments (RFC) compliant is portable across multiple Operating Systems including GNU Operating System (GNU/Linux), Berkeley Software Distribution (BSD) and Apple’s Operating System (macOS) is written from scratch in C. It is a clean implementation, which uses the Open Secure Socket Layer (OpenSSL) or Libre Secure Socket Layer (LibreSSL) library. supports EDNS0 [57](EDNS0 ) supports Domain Name System Security Extensions[50](DNSSEC) with NSEC[51](NSEC) and NSEC3 [11](NSEC3 ) has full and incremental zone transfer handling (DNS Zone Transfer Protocol[20](AXFR) and Incremental Zone Transfer[45](IXFR)). DNSSEC signing service The YADIFA software package consists of: yadifad a daemon which