Bug 1249226

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/5179

Just for clarification, expecting behavior is to show better warning message ("Please disable DNSSEC validation on all IPA servers if enabled") instead of the current, right?

DNSSEC validation is all or nothing. When it is enabled BIND validates all records. As you use zone that is not available in public internet, chain of trust cannot be validated, thus records are not valid and dropped.
You must always disable DNSSEC validation to work with these zones.

Currently validation must be disabled per each server (there is ticket for bind-dyndb-ldap to allow globally enable/disable validation on all replicas; will not be in 7.2)


If you expect any issues with DNSSEC validation enabled by default, we can change it in RHEL to disabled by default.

Martin,

Yes, a better warning message would definitely help.

It seems like I've also read that there was some plan to add command to set/modify the dnssec-* options in named.conf.  Is that the case or directly editing the file is the intended method of setting the options?

So, one last question (I hope):

Does DNSSEC require all zones and or servers have DNSSEC enabled (and be signed?)?  Or is my problem mostly that my root zone is not?

Thanks,
Scott

(In reply to Scott Poore from comment #4)
> Martin,
> 
> Yes, a better warning message would definitely help.
> 
> It seems like I've also read that there was some plan to add command to
> set/modify the dnssec-* options in named.conf.  Is that the case or directly
> editing the file is the intended method of setting the options?
> 
It is intended method to setting options directly in named.conf.
This command to modify DNSSEC setting is just nice to have feature.

> So, one last question (I hope):
> 
> Does DNSSEC require all zones and or servers have DNSSEC enabled (and be
> signed?)?  Or is my problem mostly that my root zone is not?
> 
It is not so easy.

It consist of separate issues:
* dnssec support enabled
* dnssec validation enabled
* signed zones
* validation of zones

All DNS servers should have DNSSEC support enabled (this means that the server is able to work with records with dnssec signatures). Without these signatures records cannot be validated.

If dnssec validation is enabled, then server will validate signatures of records. This feature requires to have all DNS server among path with enabled DNSSEC support.


Root zone is signed, public keys are well known.
You do not need to have signed your zones. Every signed zone must have DS record in its parent zones. This means that zone is signed by DNSSEC and server (or client) with enabled DNSSEC validation will check the signatures. If this DS record is not in parent zone, that means the zone is not signed, and only path from root zone to parent zone will be validated.

In case you use zone 'example.test.' and you have enabled DNSSEC validation, this is invalid, because root zone does not contain record 'test.', but DNS server knows that root zone is signed, so when it receives answer from forwarder (for example example.test. A 192.0.2.1) it is handled as attack, and reply is discarded, because DNSSEC validation gave proof that 'test.' zone does not exist.

This should work with for example 'testzone.redhat.com' because '.com' exists in root zone, and redhat is not signed yet.

> Thanks,
> Scott

Ok, so sounds like our AD servers are probably being handled as attack then like your test example.  So we'll need to disable until we get DNSSEC enabled on them.  I'll discuss with my team.

I think the warning is enough to finish this one off.  I don't think we need to disable it by default considering the checks already in place during install.

Thanks,
Scott

Scott, the only 'proper' solution for you is to use a properly delegated domain instead of made up one.

I.e. you should use domain like adtest.idmqe.lab.bos.redhat.com where the domain is properly delegated from parent idmqe.lab.bos.redhat.com (i.e. the NS record exists in the parent).

In that case the validator will properly detect that the domain is not signed (because there will be no DS record with public key in the parent) and it will work out of the box. Even better, you will not need to add forward zone - the forward zone is just an workaround for missing delegation from parent.


Alternatively it should work (in theory) even without delegation if your parent domain idmqe.lab.bos.redhat.com is not signed (which is not) because the validator will detect that early and do not require security proofs for child domain. In that case you will have to setup forward zone because, again, you will have to workaround the missing delegation.


Do not hesitate to ask me for help when you get to setting up the delegation. Have a nice day!

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/b4daa45baad9dca020540ecde1b1e7a9b98b1995
ipa-4-2:
https://fedorahosted.org/freeipa/changeset/32fedf03ebb0c8798cad0145e7adde58e4e9d09c

Verified.

Version ::

ipa-server-4.2.0-8.el7.x86_64

Results ::

[root@vm-idm-001 ~]# grep dnssec-validation /etc/named.conf
	dnssec-validation yes;


[root@vm-idm-001 ~]# ipa dnsforwardzone-add $AD_DOMAIN --forwarder=$AD_IP --forward-policy=only
Server will check DNS forwarder(s).
This may take some time, please wait ...
ipa: WARNING: DNSSEC validation failed: record 'adtest.qe. SOA' failed DNSSEC validation on server 10.65.206.135.
Please verify your DNSSEC configuration or disable DNSSEC validation on all IPA servers.
  Zone name: adtest.qe.
  Active zone: TRUE
  Zone forwarders: 10.65.207.38
  Forward policy: only

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2362.html