Bug 2092916 (el8_bind_dot)
| Summary: | RFE - bind 9.17.10 for gov Zero-Trust initiative for DoT/DoH requirements | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Dave <dsimes> |
| Component: | bind | Assignee: | Petr Menšík <pemensik> |
| Status: | CLOSED MIGRATED | QA Contact: | rhel-cs-infra-services-qe <rhel-cs-infra-services-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 8.6 | CC: | fkrska, mralph, msawyer, vvanhaft, wrydberg |
| Target Milestone: | rc | Keywords: | MigratedToJIRA, Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-09-21 17:55:43 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2126904 | ||
|
Description
Dave
2022-06-02 14:21:58 UTC
RHEL9: (currently) bind-9.16.23 I don't think this should be added to RHEL7. But note that we have already support of DNS over TLS in RHEL9 in unbound package, which can offer recursive resolver similar to bind. We also plan to rebase unbound to more recent version in RHEL 8, which would offer it too. It has also support for serving DNS over HTTPS to local clients, but cannot use it for forwarders. DNS over TLS can be used for forwarders. But that is not integrated with IdM. However IdM is mostly about authoritative servers, I am sure it could use unbound as recursive resolver for outgoing queries. At the moment we plan version 9.18.x to have just in Fedora and prepare it eventually for RHEL 10. It might appear in RHEL 9 later, but we don't plan inclusion BIND 9.18.x in RHEL8. We have added recently bind9.16 package as additional version, but that lacks integration with IdM. (In reply to Petr Menšík from comment #5) > I don't think this should be added to RHEL7. But note that we have already > support of DNS over TLS in RHEL9 in unbound package, which can offer > recursive resolver similar to bind. We also plan to rebase unbound to more > recent version in RHEL 8, which would offer it too. It has also support for > serving DNS over HTTPS to local clients, but cannot use it for forwarders. > DNS over TLS can be used for forwarders. But that is not integrated with > IdM. However IdM is mostly about authoritative servers, I am sure it could > use unbound as recursive resolver for outgoing queries. > > At the moment we plan version 9.18.x to have just in Fedora and prepare it > eventually for RHEL 10. It might appear in RHEL 9 later, but we don't plan > inclusion BIND 9.18.x in RHEL8. We have added recently bind9.16 package as > additional version, but that lacks integration with IdM. I already shared with the RH account team and cu on a call that this would not be feasible and unlikely. The cu updated the support case with the following, I would imagine this will be something to prioritize against other critical requests but this is a very important request for SSA and other Public Sector customers. I have adjusted the product and version accordingly. "I would like to add some context/clarity: First regarding RHEL 7. Our current systems are RHEL 7, however there is an effort underway to bring them to RHEL 8 at least. There is zero expectation that the DoH/DoT requirements will be resolved in RHEL 7. Our target is RHEL 8. We would like all required DoH/DoT components available in RHEL 8 if possible. Additionally for consideration. The basis of this is the Zero Trust effort directed by the current administration, with the components identified targeted for use by 2024. That means that each entity must report compliance or provide a detailed path to correction by that time. That brings us finally to the purpose of this RFE. To provide RH engineering a customer driven requirement to ensure proper prioritization of efforts. I suspect there will be more customers in the future with this requirement or similar ones." I haven't planned to update RHEL 8 to BIND 9.18.x, which contains support for DNS over TLS and DNS over HTTPS. We have added bind9.16 package only in a previous release, but that does not yet contain support for any TLS in BIND. Backporting seems not doable, those changes are not small. With the way we have named the package just bind9.16, it were not expected to upgrade to more recent major release. We are finishing just addition to it in Fedora. It might make us create a module this time with v9_18 stream and deprecate bind9.16 in favor of it. I think bind 9.16 and 9.18 does not differ so much as 9.11 compared to 9.16. THis BZ was discussed in a call with SSA and RH support. This is a critical issue for SSA and they requested a call with Engineering/ Product Management regarding this BZ to better understand next steps and timeline on implementation. Could you update the BZ with the next steps? If there any questions for the customer,please add them here and set to needs info-dsimes Even the latest released bind 9.18.12 in Fedora rawhide is not yet able forward queries over secured channel. I believe that is what required by the papers mentioned in this request. It means even the latest bind supports only doing recursive server with serving queries(and answers) over secure encrypted channel. But it obtains their data by normal unencrypted UDP queries, just does DNSSEC validation for signed domains. It cannot cache responses obtained via encrypted channel and offer them also via encrypted channel to local network clients. In named.conf(5) man page it documents only tls settings for listen-on and listen-on-v6 options. Not yet for forward option, which is tracked in upstream gitlab issue #3512. Already contained unbound server has forwarding over DNS over TLS protocol implemented. It supports only server interface to DNS over HTTPS, but is not able to forward received queries to DNS over HTTPS server. Even latest BIND 9.18 in Fedora does not yet have similar functionality. That is included in Known Issues in latest release. https://downloads.isc.org/isc/bind9/9.18.12/doc/arm/html/notes.html#known-issues Correction, upstream issue for forwarding is #7199. It is already merged, but not into v9_18 branch. Not part of any stable release already, just part of 9.19 development releases. It depends on changes not yet in 9.18 branch, I think. Unless that changes, it would appear only in BIND 9.20 stable release. Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug. This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there. Due to differences in account names between systems, some fields were not replicated. Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information. To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer. You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like: "Bugzilla Bug" = 1234567 In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days |