On 10/12/2023 22.32, Andrew Bartlett wrote:> On Sun, 2023-12-10 at 17:23 +0200, Sami Hulkko via samba wrote:
>> Hi,
>>
>> Is there any way of signing the zones with zone-signing key? How
>> would
>> one add add zone-signing key and key signing key to DLZ database?
>> The
>> Windows 11 Pro RSAT tool for nameserver do not accept key addition
>> and
>> states unauthorized.
> This is an interesting question. The only way this would work is if
> it was being transparently and dynamically added by the BIND9 side of
> things.
To my best knowledge in bind DLZ there is possibility to use DNSEC and
absolutely certain that standard BIND supports it.
The inclusion of ..../samba/bind-dns/named.conf has pre marking of:
dlz "[domain name]" {
# that after the inclusion of db is done
database "dlopen
/usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_18.so";
}
Both DLZ plugin and and? database where DNS information is stored are
samba products.
1. DNSSEC key saving could be supported with [samba-tool dns add....]
command and excluded from RSAT tool? until it's reverse engineering is done.
2.? One could have plugin for DNSSEC like the dlz_bind9_18.so is included.
3. On bind a insertion like in standard zone into above config could be
done.
SH
>
> Samba doesn't know how to generate the signing records and has
> unfortunate
> fixed limtiations in the records it knows how to store.
Fixed code?>
> DNSSEC is a good thing, and it is sad that Samba doesn't know how to
> support it (or check it in the recursive resolver).
>
> Sorry!
>
> Andrew Bartlett
>
>
--
Me worry? That's why my first CD was Peter Gabriel SO....
Sami Hulkko
sahulkko at gmail.com
sahulkko at icloud.com
samihulkko at quantum-black-hole.com
+358 45 85693 919