178c587654
* Stop generating RSASHA1-NSEC3-SHA1 keys on new installs since it is no longer recommended, but preserve the key on existing installs so that we continue to sign zones with existing keys to retain the chain of trust with existing DS records. * Start generating ECDSAP256SHA256 keys during setup, the current best practice (in addition to RSASHA256 which is also ok). See https://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xhtml#dns-sec-alg-numbers-1 and https://www.cloudflare.com/dns/dnssec/ecdsa-and-dnssec/. * Sign zones using all available keys rather than choosing just one based on the TLD to enable rotation/migration to the new key and to give the user some options since not every registrar/TLD supports every algorithm. * Allow a user to drop a key from signing specific domains using DOMAINS= in our key configuration file. Signing the zones with extraneous keys may increase the size of DNS responses, which isn't ideal, although I don't know if this is a problem in practice. (Although a user can delete the RSASHA1-NSEC3-SHA1 key file, the other keys will be re-generated on upgrade.) * When generating zonefiles, add a hash of all of the DNSSEC signing keys so that when the keys change the zone is definitely regenerated and re-signed. * In status checks, if DNSSEC is not active (or not valid), offer to use all of the keys that have been generated (for RSASHA1-NSEC3-SHA1 on existing installs, RSASHA256, and now ECDSAP256SHA256) with all digest types, since not all registers support everything, but list them in an order that guides users to the best practice. * In status checks, if the deployed DS record doesn't use a ECDSAP256SHA256 key, prompt the user to update their DS record. * In status checks, if multiple DS records are set, only fail if none are valid. If some use ECDSAP256SHA256 and some don't, remind the user to delete the DS records that don't. * Don't fail if the DS record uses the SHA384 digest (by pre-generating a DS record with that digest type) but don't recommend it because it is not in the IANA mandatory list yet (https://www.iana.org/assignments/ds-rr-types/ds-rr-types.xhtml). See #1953
142 lines
5 KiB
Bash
Executable file
142 lines
5 KiB
Bash
Executable file
#!/bin/bash
|
|
# DNS
|
|
# -----------------------------------------------
|
|
|
|
# This script installs packages, but the DNS zone files are only
|
|
# created by the /dns/update API in the management server because
|
|
# the set of zones (domains) hosted by the server depends on the
|
|
# mail users & aliases created by the user later.
|
|
|
|
source setup/functions.sh # load our functions
|
|
source /etc/mailinabox.conf # load global vars
|
|
|
|
# Install the packages.
|
|
#
|
|
# * nsd: The non-recursive nameserver that publishes our DNS records.
|
|
# * ldnsutils: Helper utilities for signing DNSSEC zones.
|
|
# * openssh-client: Provides ssh-keyscan which we use to create SSHFP records.
|
|
echo "Installing nsd (DNS server)..."
|
|
apt_install nsd ldnsutils openssh-client
|
|
|
|
# Prepare nsd's configuration.
|
|
|
|
mkdir -p /var/run/nsd
|
|
|
|
cat > /etc/nsd/nsd.conf << EOF;
|
|
# Do not edit. Overwritten by Mail-in-a-Box setup.
|
|
server:
|
|
hide-version: yes
|
|
logfile: "/var/log/nsd.log"
|
|
|
|
# identify the server (CH TXT ID.SERVER entry).
|
|
identity: ""
|
|
|
|
# The directory for zonefile: files.
|
|
zonesdir: "/etc/nsd/zones"
|
|
|
|
# Allows NSD to bind to IP addresses that are not (yet) added to the
|
|
# network interface. This allows nsd to start even if the network stack
|
|
# isn't fully ready, which apparently happens in some cases.
|
|
# See https://www.nlnetlabs.nl/projects/nsd/nsd.conf.5.html.
|
|
ip-transparent: yes
|
|
|
|
EOF
|
|
|
|
# Add log rotation
|
|
cat > /etc/logrotate.d/nsd <<EOF;
|
|
/var/log/nsd.log {
|
|
weekly
|
|
missingok
|
|
rotate 12
|
|
compress
|
|
delaycompress
|
|
notifempty
|
|
}
|
|
EOF
|
|
|
|
# Since we have bind9 listening on localhost for locally-generated
|
|
# DNS queries that require a recursive nameserver, and the system
|
|
# might have other network interfaces for e.g. tunnelling, we have
|
|
# to be specific about the network interfaces that nsd binds to.
|
|
for ip in $PRIVATE_IP $PRIVATE_IPV6; do
|
|
echo " ip-address: $ip" >> /etc/nsd/nsd.conf;
|
|
done
|
|
|
|
echo "include: /etc/nsd/zones.conf" >> /etc/nsd/nsd.conf;
|
|
|
|
# Create DNSSEC signing keys.
|
|
|
|
mkdir -p "$STORAGE_ROOT/dns/dnssec";
|
|
|
|
# TLDs, registrars, and validating nameservers don't all support the same algorithms,
|
|
# so we'll generate keys using a few different algorithms so that dns_update.py can
|
|
# choose which algorithm to use when generating the zonefiles. See #1953 for recent
|
|
# discussion. File for previously used algorithms (i.e. RSASHA1-NSEC3-SHA1) may still
|
|
# be in the output directory, and we'll continue to support signing zones with them
|
|
# so that trust isn't broken with deployed DS records, but we won't generate those
|
|
# keys on new systems.
|
|
FIRST=1 #NODOC
|
|
for algo in RSASHA256 ECDSAP256SHA256; do
|
|
if [ ! -f "$STORAGE_ROOT/dns/dnssec/$algo.conf" ]; then
|
|
if [ $FIRST == 1 ]; then
|
|
echo "Generating DNSSEC signing keys..."
|
|
FIRST=0 #NODOC
|
|
fi
|
|
|
|
# Create the Key-Signing Key (KSK) (with `-k`) which is the so-called
|
|
# Secure Entry Point. The domain name we provide ("_domain_") doesn't
|
|
# matter -- we'll use the same keys for all our domains.
|
|
#
|
|
# `ldns-keygen` outputs the new key's filename to stdout, which
|
|
# we're capturing into the `KSK` variable.
|
|
#
|
|
# ldns-keygen uses /dev/random for generating random numbers by default.
|
|
# This is slow and unecessary if we ensure /dev/urandom is seeded properly,
|
|
# so we use /dev/urandom. See system.sh for an explanation. See #596, #115.
|
|
# (This previously used -b 2048 but it's unclear if this setting makes sense
|
|
# for non-RSA keys, so it's removed. The RSA-based keys are not recommended
|
|
# anymore anyway.)
|
|
KSK=$(umask 077; cd $STORAGE_ROOT/dns/dnssec; ldns-keygen -r /dev/urandom -a $algo -k _domain_);
|
|
|
|
# Now create a Zone-Signing Key (ZSK) which is expected to be
|
|
# rotated more often than a KSK, although we have no plans to
|
|
# rotate it (and doing so would be difficult to do without
|
|
# disturbing DNS availability.) Omit `-k`.
|
|
# (This previously used -b 1024 but it's unclear if this setting makes sense
|
|
# for non-RSA keys, so it's removed.)
|
|
ZSK=$(umask 077; cd $STORAGE_ROOT/dns/dnssec; ldns-keygen -r /dev/urandom -a $algo _domain_);
|
|
|
|
# These generate two sets of files like:
|
|
#
|
|
# * `K_domain_.+007+08882.ds`: DS record normally provided to domain name registrar (but it's actually invalid with `_domain_` so we don't use this file)
|
|
# * `K_domain_.+007+08882.key`: public key
|
|
# * `K_domain_.+007+08882.private`: private key (secret!)
|
|
|
|
# The filenames are unpredictable and encode the key generation
|
|
# options. So we'll store the names of the files we just generated.
|
|
# We might have multiple keys down the road. This will identify
|
|
# what keys are the current keys.
|
|
cat > $STORAGE_ROOT/dns/dnssec/$algo.conf << EOF;
|
|
KSK=$KSK
|
|
ZSK=$ZSK
|
|
EOF
|
|
fi
|
|
|
|
# And loop to do the next algorithm...
|
|
done
|
|
|
|
# Force the dns_update script to be run every day to re-sign zones for DNSSEC
|
|
# before they expire. When we sign zones (in `dns_update.py`) we specify a
|
|
# 30-day validation window, so we had better re-sign before then.
|
|
cat > /etc/cron.daily/mailinabox-dnssec << EOF;
|
|
#!/bin/bash
|
|
# Mail-in-a-Box
|
|
# Re-sign any DNS zones with DNSSEC because the signatures expire periodically.
|
|
`pwd`/tools/dns_update
|
|
EOF
|
|
chmod +x /etc/cron.daily/mailinabox-dnssec
|
|
|
|
# Permit DNS queries on TCP/UDP in the firewall.
|
|
|
|
ufw_allow domain
|
|
|